Temporary skip test on Windows

Until official spdx-python-model 0.0.6 release

Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>

Author: bact

.github/workflows/install_and_test.yml

@@ -36,6 +36,13 @@ jobs:
           python -m pip install tzdata
           python -m pip install networkx
         shell: bash
+      - name: Install SPDX 3 bindings
+        # The spdx-python-model bindings are built from git and their build-time
+        # code generation does not currently work on Windows; install them only
+        # where they build so the SPDX 3 tests run there (and are skipped elsewhere).
+        if: runner.os != 'Windows'
+        run: python -m pip install ".[spdx3]"
+        shell: bash
       - name: Run tests
         run: pytest
       - name: Run CLI

pyproject.toml

@@ -37,17 +37,22 @@ dependencies = [
     "pyyaml",
     "rdflib",
     "semantic_version",
-    "spdx-python-model @ git+https://github.com/spdx/spdx-python-model.git@main",
     "uritools",
     "xmltodict",
 ]
 dynamic = ["version"]
 
 [project.optional-dependencies]
 test = ["pyshacl", "pytest", "tzdata"]
-code_style = ["black", "flake8", "isort"]
+code_style = ["black", "flake8", "isort", "mypy"]
 graph_generation = ["networkx", "pygraphviz"]
-development = ["black", "flake8", "isort", "networkx", "pyshacl", "pytest"]
+# Experimental SPDX 3.0 support is built on the spdx-python-model bindings.
+# It is an optional extra (not a core dependency) because the bindings are not
+# yet published to PyPI and must be built from git, where the build-time code
+# generation does not currently work on Windows. Keeping it optional ensures the
+# core package installs on all platforms. Install with: pip install ".[spdx3]"
+spdx3 = ["spdx-python-model @ git+https://github.com/spdx/spdx-python-model.git@main"]
+development = ["black", "flake8", "isort", "mypy", "networkx", "pyshacl", "pytest"]
 
 [project.scripts]
 pyspdxtools = "spdx_tools.spdx.clitools.pyspdxtools:main"
@@ -60,6 +65,31 @@ Repository = "https://github.com/spdx/tools-python.git"
 Issues = "https://github.com/spdx/tools-python/issues"
 Changelog = "https://github.com/spdx/tools-python/blob/main/CHANGELOG.md"
 
+[tool.mypy]
+python_version = "3.10"
+strict = true
+mypy_path = "src"
+explicit_package_bases = true
+# The new SPDX 3 code is fully typed and checked under --strict.
+# The legacy SPDX 2 modules are not strict-clean yet and are out of scope here;
+# they are excluded below so they don't mask issues in the new code.
+files = [
+    "src/spdx_tools/spdx3/formats.py",
+    "src/spdx_tools/spdx3/parser",
+]
+
+# spdx-python-model ships a py.typed marker but its generated bindings expose
+# many attributes as Any; this keeps strict checks meaningful without noise.
+[[tool.mypy.overrides]]
+module = ["spdx_python_model.*"]
+ignore_missing_imports = true
+
+# Pre-existing SPDX 2 code imported by the new modules (e.g. SPDXParsingError)
+# is not yet strict-typed; do not fail the new-code check on it.
+[[tool.mypy.overrides]]
+module = ["spdx_tools.spdx.*"]
+ignore_errors = true
+
 [tool.setuptools]
 include-package-data = true
 

src/spdx_tools/spdx3/parser/json_ld/json_ld_parser.py

@@ -8,7 +8,7 @@
 def parse_from_file(file_name: str, encoding: str = "utf-8") -> spdx_3_0.SHACLObjectSet:
     """Read a SPDX 3 JSON-LD file into a SHACLObjectSet (the in-memory representation
     provided by the spdx-python-model bindings)."""
-    object_set = spdx_3_0.SHACLObjectSet()
+    object_set: spdx_3_0.SHACLObjectSet = spdx_3_0.SHACLObjectSet()
     try:
         # The binding's deserializer reads from a binary stream.
         with open(file_name, "rb") as file:

src/spdx_tools/spdx3/parser/parse_anything.py

@@ -4,6 +4,7 @@
 
 from spdx_tools.spdx3.formats import FileFormat, file_name_to_format
 from spdx_tools.spdx3.parser.json_ld import json_ld_parser
+from spdx_tools.spdx.parser.error import SPDXParsingError
 
 
 def parse_file(file_name: str, encoding: str = "utf-8") -> spdx_3_0.SHACLObjectSet:
@@ -15,3 +16,4 @@ def parse_file(file_name: str, encoding: str = "utf-8") -> spdx_3_0.SHACLObjectS
     input_format = file_name_to_format(file_name)
     if input_format == FileFormat.JSON_LD:
         return json_ld_parser.parse_from_file(file_name, encoding)
+    raise SPDXParsingError([f"Unsupported SPDX 3 file format: {input_format}"])

tests/spdx3/conftest.py

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2026-present SPDX contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# The SPDX 3 support depends on the optional `spdx-python-model` bindings, which
+# are not installed by default and currently cannot be built from git on Windows.
+# When the bindings are unavailable, skip collecting the SPDX 3 test suite instead
+# of failing at import time.
+try:
+    import spdx_python_model  # noqa: F401
+except ImportError:
+    collect_ignore_glob = ["*"]